How does Kon Boot Works

Have you ever asked yourself about HOW KON-BOOT WORKS ??

What is KON-BOOT:

Kon Boot is an application which will bypass the authentication process of Windows based operating systems. Kon Boot can work on a USB flash drive, CD, or floppy diskette.

watch the video down below to see it in action

Now how does it works ??

The source code of Kon-boot has not been published by its author so it is not known what it does exactly to hack the operating system. However some hypothesis can be made based on known technologies to determine how it works. In general, bootkits basically hook the 0x13 interruption routine that is usually provided by the BIOS of the computer. The role of this routine is to read sectors from the hard disk and to load them into a given location in RAM memory. By hooking this routine, bootkits such as Kon-boot or Vbootkit modify directly the code of the operating system when it is copied into main memory, just before its execution.

Note that Kon-Boot works with local accounts and domain accounts that have the credentials locally cached. I can't log on without a password for a domain account whose password isn't cached locally. Also, once I'm logged on with a domain account, no contact with the domain has taken place, so I have no token. So I can't talk to network resources as the domain account, I can just access local content on the box with that user's permissions.

This isn't really much different from many system recovery tools out there that enable access to NTFS volumes outside of Windows for recovery or password reset solutions. In fact, Microsoft provides its own set of solutions as part of the Desktop Optimization Pack in the form of Desktop and Recovery Toolset (DART), which has a local account password reset and NTFS access tool.

Like most other security bypass products and recovery solutions, Kon-Boot requires physical access to the box. If you give someone unprotected physical access to the box there, are many products and methods to gain access to information. There are key steps you can perform to provide protection from these attacks:

These basic steps will provide protection from most types of physical attack, including Kon-Boot.

Comments

TCP Flood & IP Spoofing Tutorial - Hping3 (With Effective Tricks)

hping is a command-line oriented TCP/IP packet assembler/analyzer. Using hping3 you are able to perform at least the following stuff: Test firewall rules Testing Network performance using different protocols, packet size, TOS (type of service) and fragmentation Remote OS fingerprinting. TCP/IP stack auditing Today, we will use hping3 for testing network performance. In other words we will use it to do DDOS Attack Tests. We can start “Help Document” by typing “hping3 --help” on the command line. Hping3 Important Parameters : The flood parameter : Activates the fastest packet sending mode The destport(p) parameter : Specifies the destination port The spoof(a) parameter : Specifies which IP Adress is to be spoofed The rand-source parameter : Activates the random source address mode Although the above parameters are important, it should be selected which flag is set to determine the main attack type. Main Attack Types : The syn(S) parameter: Specifies tha

Top 110 Free Proxy Sites – Best Free Proxy Servers List 2017

Sometimes you may face problem while accessing some websites either it says this webpage is not available or this website/url has been blocked. If you still want to access a useful website from a place where it is blocked, the best way to access a blocked website is by using a proxy websites. Proxy sites can open restricted website which are blocked in colleges, schools, government offices, IP restricted etc. Proxy sites not only help you to access blocked websites, it also help to surf internet anonymously. Proxy sites are very easy to use. They redirect your network traffic through their servers so that you can access those websites because their servers are not blocked to access that site. So here in this tutorial we are providing you the list of top 110 proxy servers. The below we listed the best proxy sites: Skull Proxy: Skull Proxy is a new yet very powerful proxy server that should take you to your desired site with a blazing loading time. Hidester: Peo

NSA Releases GHIDRA 9.0 — Free, Powerful Reverse Engineering Tool

The United States' National Security Agency (NSA) today finally released GHIDRA version 9.0 for free, the agency’s home-grown classified software reverse engineering tool that agency experts have been using internally for over a decade to hunt down security bugs in software and applications. GHIDRA is a Java-based reverse engineering framework that features a graphical user interface (GUI) and has been designed to run on a variety of platforms including Windows, macOS, and Linux. Reverse engineering a program or software involves disassembling, i.e. converting binary instructions into assembly code when its source code is unavailable, helping software engineers, especially malware analysts, understand the functionality of the code and actual design and implementation information. Download GHIDRA 9.0 — software package, slides, and exercises Adapted from thehackernews.com

Alfa Leet

Search This Blog